Creating expired X.509 certificates
Last week as I was preparing a the material for a workshop about TLS for developers, for one of the exercises, I needed to create an expired certificate.
To do that I thought that when creating my certificate (self signed) all I had to do was to pass a negative number when specifying the numbers of days for the certificate validity.
So there I went and run the following command:
openssl req -x509 -newkey rsa:4096 -keyout server.key -out server.crt -days -5 req: Non-positive number "-5" for -days req: Use -help for summary.
As you can see, that didn’t work.
After looking around for a bit, all the solutions I initially found, involved changing my system’s date and then generate the certificate. I didn’t like that option. So my next thought was to create the certificate in a Docker container. I would change the container’s date and then run my
openssl command. Let’s try that:
docker run -it --rm ubuntu:18.04 root@c09ad5d2689d:/# date +%Y%m%d -s "20200101" date: cannot set date: Operation not permitted 20200101 root@c09ad5d2689d:/#
As you can see that didn’t work either. Can you change the date from inside the container? You could, but to do that you need to run the container with higher privileges (–privileged). The reason for this is that the container shares the system’s clock, and therefore, changing the date inside the container would also change the host’s date. So back to square number 1.
I went back to look for other options and finally I found this nice tool called faketime. According to its documentation this is just a simple layer on top of libfaketime. This last one is a library that capture some system calls (time and fstats) and allows you using the LD_PRELOAD functionality to set a specific date and time for a particular application.
So going back to my quest, let’s create a certificate only valid for 1 day between the 1st and 2nd of January of 2020:
faketime '2020-01-01' openssl req -x509 -newkey rsa:4096 -keyout server.key -out server.crt -days 1
Let’s verify that our certificate has the validity period we meant to set:
openssl x509 -in server.crt -text -noout ... Validity Not Before: Jan 1 00:00:05 2020 GMT Not After : Jan 2 00:00:05 2020 GMT ...
faketime accepts different ways to set the date and time:
faketime 'last Friday 5 pm' /bin/date faketime '2008-12-24 08:15:42' /bin/date faketime -f '+2,5y x10,0' /bin/bash -c 'date; while true; do echo $SECONDS ; sleep 1 ; done' ... ...
You can either install
faketime in your system or you can use a Docker container. If you take the container option you can do this manually or using doig:
doig -u -i mytools -t faketime
And then run your container:
docker run -it --rm mytools
From there you mess with
faketime without having to worry messing up your system’s date.
By the way, if you are looking for “certificates with issues”, https://badssl.com is a great resource to find all kind of certificates with different issues.
- Creating expired X.509 certificates
- Docker image generator for infosec
- Extending kubectl
- How kubectl uses Kubernetes API
- Moving the blog images from Flickr to Digital Ocean Spaces
- Controlling your garage doors with an ESP32 - Part 3
- Controlling your garage doors with an ESP32 - Part 2
- Controlling your garage doors with an ESP32 - Part 1
- Size matters, but it is not all about the size